[FFmpeg-cvslog] avcodec/speedhq: Check buf_size to be big enough for DC

[Michael Niedermayer]

ffmpeg | branch: release/4.1 | Michael Niedermayer <michael at niedermayer.cc> | Thu Oct  6 22:28:33 2022 +0200| [0bc8a2c295aeee83330a5b45cf133e6149e8272d] | committer: Michael Niedermayer

avcodec/speedhq: Check buf_size to be big enough for DC

Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 9184d3d7b64459e975f26284a7b2e26cbf76480b)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0bc8a2c295aeee83330a5b45cf133e6149e8272d
---

 libavcodec/speedhq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/speedhq.c b/libavcodec/speedhq.c
index a3b0bc4649..27aab11903 100644
--- a/libavcodec/speedhq.c
+++ b/libavcodec/speedhq.c
@@ -426,6 +426,8 @@ static int speedhq_decode_frame(AVCodecContext *avctx,
 
     if (buf_size < 4 || avctx->width < 8 || avctx->width % 8 != 0)
         return AVERROR_INVALIDDATA;
+    if (buf_size < avctx->width*avctx->height / 64 / 4)
+        return AVERROR_INVALIDDATA;
 
     quality = buf[0];
     if (quality >= 100) {